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IS TSA’S PLANNED PURCHASE OF CAT/BPSS A 
WISE USE OF TAXPAYER DOLLARS? 


Tuesday, June 19, 2012 

U.S. House of Representatives, 

Subcommittee on Transportation Security, 

Committee on Homeland Security, 

Washington, DC. 

The subcommittee met, pursuant to call, at 2:17 p.m., in Room 
311, Cannon House Office Building, Hon. Mike Rogers [Chairman 
of the subcommittee] presiding. 

Present: Representatives Rogers, Walberg, Cravaack, and Jack- 
son Lee. 

Mr. Rogers. This Committee on Homeland Security, Sub- 
committee on Transportation Security will come to order. The sub- 
committee is meeting today to examine whether TSA’s Credential 
Authentication Technology Boarding Pass Screening — or Scanning 
System, commonly referred to as CAT/BPSS, is a smart use of tax- 
payer’s funds. 

I want to thank our witnesses for being here today, and I appre- 
ciate your time and energy in preparing for today’s hearing. I know 
it takes a lot of time and commitment, and I appreciate that. We 
look forward to your testimony. 

TSA has plans to purchase Credential Authentication Technology 
Boarding Pass Scanning Systems, commonly referred to as CAT/ 
BPSS. You will hear me refer to it as the new technology because 
it is easier to say than CAT/BPSS. 

Eventually, the idea is to have this technology replace today’s 
manual travel document checking process with an automated proc- 
ess. While the technology may assist screeners in detecting fake 
IDs and boarding passes, TSA has not addressed several funda- 
mental weaknesses in the technology that could render it ineffec- 
tive. 

As TSA attempts to rebrand itself as a threat-driven agency, 
CAT/BPSS sticks out like a sore thumb. Here are three of the prob- 
lems we have identified with this looming purchase: CAT/BPSS is 
not integrated into TSA’s other security layers, such as the ter- 
rorist watch list. No. 2, the costs of CAT/BPSS have grown expo- 
nentially since TSA first started looking at this. According to TSA 
figures, acquisition went from $35 million to $115 million, and pro- 
jected life-cycle costs went from $83 million to $150 million. Fi- 
nally, TSA plans to purchase over 1,000 of these units over a span 
of a few months. That does not appear to be a risk-based approach. 
For those who don’t know, TSA already has a lot of extra equip- 
ment sitting in storage. Mr. Hoggan, we don’t need any more. 

( 1 ) 
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This hearing will provide an important opportunity to hear more 
about TSA’s plans for CAT/BPSS and examine whether the tech- 
nology makes us more secure and is a wise use of taxpayer’s dol- 
lars. Last week, I sent Administrator Pistole a letter expressing my 
concerns with the technology. If there is no objection, I want to in- 
sert that into the record at this time. 

So ordered. 

[The information follows:] 

Letter From Chairman Mike Rogers to John S. Pistole 

June 11, 2012. 

Honorable John S. Pistole, 

Administrator, Transportation Security Administration, 601 South 12th Street, Ar- 
lington, VA 20598. 

Dear Administrator Pistole: I am writing to express my concerns regarding the 
TSA’s plans to purchase and deploy Credential Authentication Technology/Boarding 
Pass Scanning Systems (CAT/BPSS). While CAT/BPSS may assist Transportation 
Security Officers in detecting fraudulent or invalid IDs and boarding passes, there 
are a number of weaknesses with this technology that call into question the benefit 
of deploying up to 1,400 units. On May 30, 2012, I appreciated the opportunity for 
my staff and I to receive a briefing and demonstration of CAT/BPSS at the TSA’s 
Systems Integration Facility (TSIF). However, our discussion with the CAT/BPSS 
program team further reinforced our concerns, as outlined below. 

As you know, the Subcommittee on Transportation Security has held a number 
of hearings on technology procurement reform at TSA. While we are beginning to 
see some improvements, including greater transparency with industry, I am con- 
cerned that CAT/BPSS falls short in the area of requirements generation and col- 
laboration with the Science and Technology (S&T) Directorate. It appears that the 
development and deployment of CAT/BPSS technology lacks two critical consider- 
ations: (1) A thorough risk analysis of the threat scenarios that the technology ad- 
dresses and its associated cost-benefit, and (2) the necessary system requirements 
to achieve risk-based operational success. 

I commend TSA’s emphasis to move towards a more risk-based approach to air- 
port security, so I am puzzled by the apparent lack of risk and cost-benefit analyses 
for the CAT/BPSS technology. My staff and I have requested several times that TSA 
provide us an analysis of the projected costs for the CAT/BPSS units, especially 
given that there is a planned large-scale acquisition as early as 5 months from now. 
TSA has provided neither cost projections nor cost threshold requirements for the 
technology. Secondly, while the technology is claimed to be part of a layered ap- 
proach to airport security screening, we have not seen any risk analysis that sup- 
ports the role of this technology in the overall security architecture. Specifically, the 
technology only detects potentially fraudulent documents, and does little or nothing 
to link these potentially fraudulent documents to terrorist-related threats. CAT/ 
BPSS provides no interconnectivity to other Government threat databases, provides 
no protection against falsification of IDs at the issuing source, and provides limited 
assurance that damaged or misprinted, but valid IDs (or boarding passes) can be 
correctly processed by the system. 

I also commend TSA for its use of systems engineering principles in developing 
a set of operational requirements for the CAT/BPSS technology. However, I remain 
deeply concerned, due to the lack of risk-based analyses, that some key require- 
ments have been excluded. Examples of missing requirements that have been ob- 
served include: 

• No requirement for interconnectivity to other security systems within or exter- 
nal to the TSA system architecture. 

• No requirement for false alarm rates. Since only detection rates and throughput 
rates are specified, the “threshold settings” will likely be set to such a low rate 
that potential threats will pass through undetected. 

• No requirement for human factors. How do we avoid false confidence by the 
TSOs as they see repeated readings of “PASS” by the automated screens? How 
do we ensure that the technology does not distract from the TSOs’ ability to ob- 
serve passengers for behavioral cues? 

• No requirement for phasing in the technology, based on risk and effectiveness. 
The acquisition plans call for a bulk procurement of 1,400 CAT/BPSS units for 
deployment at 50% of all lanes at all airports. Based on prior TSA technology 
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experiences, it would seem that a more phased, risk-based procurement and im- 
plementation would be prudent. 

As you are aware, I intend to hold a hearing on CAT/BP8S next week. This hear- 
ing will provide TSA the opportunity to clarify the issues and offer solutions for a 
path forward. In preparation for this hearing, I request that TSA provide the fol- 
lowing information by June 15, 2012: 

• Projected costs of CAT/BPSS, including per-limit costs and projected life-cycle 
costs. 

• Requirements documents for CAT/BPSS. 

• Risk analyses conducted on CAT/BPSS, including quantitative assessments of 
the terrorist-based threats that CAT/BPSS will address, and its role in the over- 
all TSA security system architecture. 

• Delineation of the ways in which the S&T Directorate has been engaged and 
what its expert feedback has been. At my visit to the TSIF on May 30, 2012, 
the CAT/BPSS program team affirmed there was some level of collaboration 
with S&T. Since that time, the S&T Directorate has denied having a role in 
CAT/BPSS development. 

Thank you for your prompt and personal attention to this matter. I appreciate 
your continuing efforts to secure the Nation’s transportation systems and look for- 
ward to working with you to improve TSA’s performance in carrying out its critical 
mission. 

Sincerely, 


Mike Rogers, 

Chairman, Subcommittee on Transportation Security. 


Mr. Rogers. Mr. Hoggan, while you are very new to this posi- 
tion, this subcommittee has held a number of hearings on tech- 
nology procurement reform at TSA in which we identified a long 
list of procurement problems and heard testimony from your prede- 
cessor on the subject. 

While we are beginning to see some general improvements, I am 
concerned that CAT/BPSS falls into the same familiar pattern of 
TSA procurement and completely misses the mark. At this point, 
I think CAT/BPSS is a Band-aid measure to solving a complex 
problem. 

The travel document checker can’t perform the way we want it 
to — want him or her to do, so instead of revising training stand- 
ards, the management protocols and operational procedures, TSA is 
looking for a quick fix. While an automated process makes sense, 
TSA has not addressed flaws that plague the technology, and more 
importantly, TSA checkpoints operation — checkpoint operations as 
a whole. 

Today, I expect concrete answers about the benefits and gaps as- 
sociated with CAT/BPSS and exactly what changed your mind 
about it. Based on the information the committee received late on 
Friday, you have decide to postpone procurement of this technology 
until next year. I am encouraged by that news, but I can assure 
that our oversight of this program and other acquisitions will con- 
tinue to be robust. 

With that, I would ordinarily now turn to my Ranking Member, 
Sheila Jackson Lee of Texas. She is involved in another committee 
and will be here shortly, and we will pause when she arrives to rec- 
ognize her for an opening statement. 

Now we are pleased to recognize our witnesses. By the way, the 
other committee Members are reminded they can submit their 
statements for the record. We are pleased to have two distin- 
guished witnesses before us today on this important topic. Let me 
remind each of the witnesses that their entire written statements 
will be submitted for the record. 
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Our first witness, Mr. Kelly Hoggan, currently serves as an as- 
sistant administrator for the Office of Security Capabilities at TSA, 
a position he assumed this past March. I think it was April, wasn’t 
it? April? 

Mr. Hoggan. April 8. 

Mr. Rogers. April 8. In this position, Mr. Hoggan is responsible 
for the implementation and development of security technologies 
across multiple modes of transportation. Mr. Hoggan joined TSA in 
2004 and has served in numerous leadership positions, most re- 
cently as the regional director for the Office of Global Strategies 
based in Singapore, where he was responsible for overseeing TSA’s 
regional tactical operations. 

Mr. Hoggan is also served as the deputy administrative — assist- 
ant administrator for the Office of Global Strategies and a deputy 
assistant administrator for the Office of Security Operations. The 
Chairman now recognizes Mr. Hoggan for 5 minutes for your own 
opening statement. 

STATEMENT OF KELLY HOGGAN, ASSISTANT ADMINISTRATOR, 

OFFICE OF SECURITY CAPABILITIES, TRANSPORTATION SE- 
CURITY ADMINISTRATION 

Mr. Hoggan. Thank you, Chairman Rogers and distinguished 
Members of the subcommittee. Thank you for the opportunity to 
testify about the Transportation Security Administration’s use of 
technology to support a layered approach to securing the Nation’s 
transportation system, while ensuring freedom of movement for 
people and commerce. 

TSA’s workforce responsibilities include security screening of 
passengers and baggage at more than 450 airports in the United 
States, facilitating air travel for 1.8 million people per day. We also 
vet more than 14 million passenger reservations, 13 million trans- 
portation workers against a terrorist watch list every week. 

One way in which our security approach continues evolving is by 
investing in innovative technologies and pursuing initiatives that 
further standardize and integrate equipment. I appreciate the op- 
portunity to discuss with the subcommittee TSA’s efforts to 
strengthen our multi-layered security system through technology 
innovation. 

As you know, last fall TSA began developing a strategy for en- 
hanced use of intelligence to help implement a risk-based approach 
to transportation security. Our objective is to mitigate risk in a 
way that effectively balances security measures with privacy, civil 
rights, and civil liberty concerns. 

Through various risk-based security, or RBS, initiatives, TSA is 
moving away from a one-size-fits-all security model and close to its 
goal of providing the most effective transportation security in the 
most efficient way possible. 

Perhaps the most widely-known enhancement we are putting in 
place is TSA PreCheck, which, like other RBS initiatives, leverages 
our advancements in technology. 

For example, we are able to leverage our secure-flight technology 
in a manner that identifies lower risk passengers and distin- 
guishing them in a checkpoint through barcodes on their boarding 
passes. 
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Another initiative we are currently testing in a handful of air- 
ports is a credential authentication technology boarding pass scan- 
ning system, or CAT/BPSS, to provide TSO’s with an effective tool 
to quickly detect fraudulent and altered documents. 

This equipment automatically and currently verifies passenger 
boarding passes and IDs as they are presented to TSA during the 
security checkpoint screening process. 

Using CAT/BPSS, TSA can verify the authenticity of a pas- 
senger’s ID by comparing the format and security features of a pas- 
senger’s against a known set of security features for that particular 
identity credential type. 

Most legitimate forms of identification issued today includes 
some forms of encoded data that is written into the credential by 
the issuing authority in one or more widely-accepted formats. The 
most common form of formats include one- and two-dimensional 
bar codes, magnetic strips, embedded circuits, machine readable 
text. 

The formatted security features set for each credential type were 
provided to the TSA by the credential issuers so that TSA can com- 
pare the security features on the passenger ID with the security 
features provided by the credential issuer. 

TSA is currently conducting CAT/BPSS technology pilots in San 
Juan, Houston Air Continental and Dulles Washington Airports. 
During the process, TSA is evaluating the throughput as well as 
determining the overall operational availability of the various solu- 
tions. 

If testing proves successful, CAT/BPSS units could replace Travel 
Document Checker podiums in the entrance of airport security 
checkpoints and the current manual lights and loupes process for 
boarding pass authentication. 

TSA is also in the process of upgrading currently deployed AT X- 
ray systems as well as deploying next generation AT2 systems. 
This technology is used to screen carry-on luggage at security 
checkpoints in addition to other upgrades to streamline the bag- 
gage check process. 

Next generation A2X-Ray units featured enhanced explosive de- 
tection capabilities to help our officers detect new threats. There 
are currently more than 1,400 AT units at 125 airports with addi- 
tional deployments for the remainder of the calendar year 2012. 

We are working close with DHS S&T and our qualified vendor 
list to assess the AT2 system’s capability to detect liquid, aerosols, 
and gels, commonly known as LAGs, which could expedite the sec- 
ondary bag search process. 

Bottle liquid scanners, or BLS, security screening systems are 
used to detect potential liquids or gels threats while differentiating 
between liquid explosives and common benign liquids such as baby 
formula and insulin. 

Next-generation BLS systems have the ability to detect a wider 
range of explosive material and use light waves to screen sealed 
containers for explosive liquids. 

TSA recently deployed an additional 500 next-generation BLS 
units to airports Nation-wide and now is a total of 1,200 at 350 air- 
ports. Going forward, TSA will continue its efforts to strengthen 
this multi-layer security system through technological advances. 
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Chairman Rogers, thank you, once again, for the opportunity for 
today. 

[The statement of Mr. Hoggan follows:] 

Prepared Statement of Kelly Hoggan 
June 19, 2012 

Good afternoon Chairman Rogers, Ranking Member Jackson Lee, and distin- 
guished Members of the subcommittee. Thank you for the opportunity to testify 
today about the Transportation Security Administration’s (TSA) use of technology 
to support our layered approach to securing the Nation’s transportation systems 
while ensuring freedom of movement for people and commerce. TSA employs risk- 
based, intelligence-driven measures to deter and prevent terrorist attacks and to re- 
duce vulnerabilities in the Nation’s transportation systems. In partnership with air- 
port operators, airlines, and local law enforcement agencies, TSA secures our Na- 
tion’s commercial airports through a variety of programs that create a multi-layered 
system of transportation security to mitigate risk. 

The TSA workforce operates on the front line, executing the agency’s transpor- 
tation security responsibilities in support of the Nation’s counterterrorism efforts. 
These responsibilities include security screening of passengers and baggage at over 
450 airports in the United States that facilitate air travel for 1.8 million people per 
day; recurrently vetting over 13 million transportation workers against the terrorist 
watch list each day; and conducting security regulation compliance inspections and 
enforcement activities at airports, for domestic and foreign air carriers, and for air 
cargo screening operations throughout the United States and at last point of depar- 
ture locations internationally. In 2011, Transportation Security Officers (TSOs) 
stopped more than 125,000 prohibited items at airport checkpoints. Of those items, 
more than 1,300 were firearms. 

Since our creation in the wake of the September 11 terrorist attacks, TSA has 
evolved our security approach based on intelligence and by examining how specific 
security procedures are carried out, improving workforce efficiencies, investing in in- 
novative technologies and pursuing initiatives to further standardize and integrate 
equipment. Following our Congressional mandate to keep the millions of Americans 
who travel each day safe and secure across numerous modes of transportation, TSA 
has strengthened security by creating successful programs and deploying tech- 
nologies that were not in place prior to September 11, while also taking steps when- 
ever possible to enhance the passenger experience. 

I am pleased to have an opportunity today to discuss with the subcommittee 
TSA’s technological innovations, which have strengthened our multi-layered security 
system. 


RISK-BASED SECURITY (RBS) AND TSA PRECHECK 

Last fall, TSA began developing a strategy for enhanced use of intelligence and 
other information to support a more risk-based approach in all facets of transpor- 
tation, including passenger screening, air cargo, and surface transportation. At its 
core, the concept of RBS builds upon the work TSA has been doing throughout its 
first decade of service to the Nation. Our objective is to mitigate the risk of an at- 
tack against our transportation systems in a way that effectively balances security 
measures with privacy, civil rights, and civil liberties concerns while promoting the 
safe movement of people and commerce. 

Through various RBS initiatives, TSA is moving away from a one-size-fits-all se- 
curity model and closer to its goal of providing the most effective transportation se- 
curity in the most efficient way possible. In the passenger screening context, RBS 
allows our dedicated TSOs to focus more attention on those travelers we believe are 
more likely to pose a risk to our transportation network while providing the oppor- 
tunity for expedited screening to those we consider pose less risk. The most widely 
known risk-based security enhancement we are putting in place is TSA PreCheck™, 
which, like other RBS initiatives, leverages our advancements in technology. Since 
first implementing this idea last fall, TSA PreCheck™ has been expanded to 15 air- 
ports, making it possible for eligible passengers flying from these airports to experi- 
ence expedited security screening through TSA PreCheck™. The feedback we’ve 
been receiving is consistently positive. TSA pre-screens TSA PreCheck™ passengers 
each time they fly through participating airports. Currently, U.S. citizens flying do- 
mestically who are qualified frequent fliers of American Airlines, Delta Air Lines, 
and Alaska Airlines, or members of U.S. Customs and Border Protection’s trusted 
traveler programs such as Global Entry, may be eligible for expedited screening at 
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select checkpoints. TSA is actively working with other major air carriers such as 
United Airlines, US Airways, and Jet Blue to expand both the number of partici- 
pating airlines and the number of airports where expedited screening through TSA 
PreCheck™ is provided. By the end of 2012, TSA plans to have TSA PreCheck™ 
operating at over 30 of the Nation’s busiest airports. 

TSA PreCheck™ travelers are able to divest fewer items, which may include leav- 
ing on their shoes, jacket, and light outerwear as well as other modifications to the 
standard screening process. As always, TSA will continue to incorporate random and 
unpredictable security measures throughout the security process. At no point are 
TSA PreCheck™ travelers guaranteed expedited screening. 

CREDENTIAL AUTHENTICATION TECHNOLOGY/BOARDING PASS SCANNING SYSTEMS 

TSA is currently evaluating a new technology to improve the effectiveness of 
verifying and validating passengers’ travel and identity credentials (ID). This Cre- 
dential Authentication Technology/Boarding Pass Scanning System (CAT/BPSS), 
provides TSOs with an effective tool to quickly detect fraudulent or altered IDs or 
boarding passes, ensure that the identity information on the ID and boarding pass 
match, and automatically identify passengers that have been selected, under the 
RBS concept, for differentiated screening. 

CAT/BPSS provides TSA with a greater ability to identify fraudulent ID docu- 
ments and can verify the authenticity of boarding passes. CAT/BPSS compares the 
format and security features of the passenger ID against a known set of security 
features for that particular identity credential type. The most common security fea- 
tures are one and two dimensional (ID, 2D) barcodes, magnetic stripes, embedded 
circuits, and machine readable text. 

TSA is currently concluding CAT/BPSS technology pilots at San Juan, Houston, 
and Washington Dulles airports. During this technical evaluation process, TSA is 
determining the overall operational suitability of different vendor solutions. Prior to 
proceeding to the field pilots each CAT/BPSS system were required to go through 
two rounds of qualification testing plus two additional rounds of regression testing, 
to remediate issues identified during qualification testing, at the TSA Systems Inte- 
gration Facility (TSIF). 

If testing proves successful, CAT/BPSS units could replace the Travel Document 
Checker podium at the entrance of airport security checkpoints as well as the cur- 
rent manual method of ID and boarding pass authentication with a more effective 
security measure. 


ADVANCED IMAGING TECHNOLOGY 

Advanced Imaging Technology (AIT) helps TSOs screen passengers for metallic 
and non-metallic threats including weapons, explosives, and other objects concealed 
under layers of clothing without physical contact. Currently, there are more than 
700 AIT units at nearly 190 airports. AIT is a critical component of TSA’s risk-based 
security approach. Consistent with recent U.S. Department of Homeland Security 
(DHS), Office of Inspector General (OIG), and Government Accountability Office 
(GAO) recommendations, TSA is implementing an action plan to increase the level 
of available AIT screening capacity across the Nation’s aviation system. Where AIT 
is deployed and relied upon, TSA has established a utilization target consistent with 
the recommendation by OIG, and is meeting or exceeding that target. 

TSA has developed and implemented an AIT instructor certification curriculum 
for Security Training Instructors (ST!) assigned at the airports. These STIs are re- 
sponsible for delivering AIT training as airports receive the technology. A full train- 
ing curriculum package, including training kits and training aids, has been distrib- 
uted to all AIT airports and allows each airport to train as many operators as re- 
quired. Airports that have not received AIT units will receive the training kit and 
aids when the equipment is installed. 

In addition, introduction of Automated Target Recognition (ATR) functionality 
eliminates the need for a remote Image Operator in all new machines. ATR capa- 
bility is being retrofitted on all existing machines using millimeter-wave technology, 
and TSA is currently completing the evaluation of ATR on Backscatter AIT systems. 
The ATR software provides the same high level of detection and it allows for more 
targeted pat-downs, because of the manner in which anomalies are displayed. The 
introduction of ATR reduced the amount of time required for initial operator train- 
ing and certification. By using local airport STIs to conduct this training, TSA has 
eliminated concerns about training being a constraint in achieving our AlT utiliza- 
tion goal. 

The availability of AIT equipment supports long-term needs while increasing effi- 
ciencies at checkpoints with even more effective ATR software and a reduced foot- 
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print, which will inform future deployment strategies. In support of the increasing 
number of AIT units deployed with ATR, TSA is developing a new training kit spe- 
cifically designed to support AIT ATR training and testing. Working with the Johns 
Hopkins University Applied Physics Laboratory, TSA is also working to increase the 
number of AIT testing scenarios under our Aviation Screening Assessment Program 
(ASAP). TSA has been conducting a preliminary assessment to develop and validate 
additional testing stimulants and scenarios for use with the AIT ATR equipment. 
The intent is to incorporate new scenarios and stimulants appropriate for use with 
AIT ATR into ASAP’s National-level testing framework. TSA is also working with 
industry in order to enhance ATR and AIT hardware for greater detection effective- 
ness. 


AUTOMATED WAIT TIME 

Automated Wait Time (AWT) systems utilize technology to monitor and track 
queuing traffic at the security checkpoint, enabling TSA to reallocate resources to 
areas of higher congestion and priority as needed. The AWT system includes the 
ability to display wait times to the traveling public on monitors within airport 
checkpoints. TSA preliminarily tested an AWT system at the TSIF and anticipates 
testing it in airports in the coming months. 

NEXT GENERATION ADVANCED TECHNOLOGY X-RAY 

TSA is in the process of upgrading currently deployed Advanced Technology (AT) 
X-ray systems, as well as deploying next generation, or AT-2 systems. This tech- 
nology is used to screen carry-on luggage at the security checkpoint. In addition to 
other upgrades that streamline the bag check process, next generation AT X-ray 
units feature enhanced explosive detection capabilities that enable TSA to detect ad- 
ditional threats. 

There are currently more than 1,400 AT units at over 125 airports. These systems 
enhance security effectiveness and efficiency, and deployments will continue through 
calendar year 2012. We are working closely with the DHS Science and Technology 
Directorate (S&T) and our qualified vendors to assess the AT-2 system’s capability 
to detect liquids, aerosols, and gels (LAG), which would provide the TSOs more effi- 
cient tools to perform a targeted bag search. 

SHOE-SCANNING DETECTION TECHNOLOGY 

Shoe-Scanning Detection (SSD) technology is an advanced technology which would 
be capable of detecting both metallic and non-metallic threats concealed in pas- 
senger footwear without requiring that passengers to remove their footwear at the 
checkpoint. S&T recently issued a Broad Agency Announcement that allows it to 
support private-sector R&D research and development efforts to develop shoe-scan- 
ner detection systems that meet TSA detection requirements. 

BOTTLED LIQUIDS SCANNERS 

Bottled Liquids Scanner (BLS) screening systems are used to detect potential liq- 
uid or gel threats, which may be contained in a passenger’s property while differen- 
tiating between liquid explosives and common, benign liquid such as baby formula 
and insulin. Next-generation BLS screening systems have the ability to detect a 
wider range of explosive materials and use light waves to screen sealed containers 
for explosive liquids. TSA recently deployed an additional 500 next-generation BLS 
units to airports Nation-wide. These recent deployments bring the total number of 
BLS units Nation-wide to over 1,200 at nearly 350 airports. 

EXPLOSIVES TRACE DETECTION 

Explosives Trace Detection (ETD) technology is used at security checkpoints 
around the country to screen passengers and their carry-on baggage for traces of 
explosives. Officers may swab a piece of luggage or passenger hands and place the 
swab inside the ETD unit to analyze the content for the presence of potential explo- 
sive residue. TSA is focusing on recapitalization efforts to perform life-cycle replace- 
ments with more effective next-generation solutions. In addition, TSA is expanding 
its use of ETD technology in airports as part of its layered approach to aviation se- 
curity. TSA is currently conducting pilot testing on portable trace solutions to sup- 
port more widespread usage of this technology and working with S&T on the devel- 
opment of next-generation ETDs. 
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EXPLOSIVES DETECTION SYSTEMS RECAPITALIZATION AND OPTIMIZATION 

Over the next 5 years, a large number of Explosives Detection Systems (EDS) will 
approach the end of their useful life and replacing these aging units is a top pri- 
ority. TSA will fund recapitalization projects, which include the work required to re- 
move the existing EDS as well as minimal modifications to the Baggage Handling 
System infrastructure associated with the replacement of the EDS and the associ- 
ated purchase and installation of the new EDS. TSA’s plan to replace the aging EDS 
fleet of equipment will be prioritized based on a combination of age and mainte- 
nance data. 


CONCLUSION 

TSA will continue to enhance its layered security approach through state-of-the- 
art technologies, expanded use of existing and proven technology, passenger pre- 
screening and other developments that will continue to strengthen aviation security. 
Thank you for the opportunity to appear before you today, and I look forward to 
answering your questions. 

Mr. Rogers. Thanks, Mr. Hoggan. 

Our next witness is Mr. Steve Lord. Mr. Lord is a GAO executive 
responsible for directing numerous engagements on aviation and 
surface transportation issues and regularly discusses these issues 
before Congress and at industry forums. 

He has recently conducted in-depth reviews of the TSA’s pas- 
senger checked baggage and air-cargo screening operations. Before 
his appointment to the Senior Executive Service in 2007, he led 
GAO’s work on a number of key international security, finance, and 
trade issues. 

Mr. Lord, we appreciate you appearing before this committee on 
many occasions and look forward to your testimony today. The 
Chairman now recognizes Mr. Lord for his statement. 

STATEMENT OF STEPHEN M. LORD, DIRECTOR, HOMELAND 

SECURITY AND JUSTICE ISSUES, GOVERNMENT ACCOUNT- 
ABILITY OFFICE 

Mr. Lord. Thank you, Mr. Chairman. Chairman Rogers and 
other distinguished Members of the committee, I am pleased to be 
here today to discuss TSA’s efforts to acquire this new technology. 
I don’t use the acronym either. Some of our past work on TSA ac- 
quisitions which could inform the deliberations over TSA’s progress 
in procuring this: 

This is an important issue as TSA acquisitions represent billions 
of dollars in life-cycle costs and support a wide range of missions. 
As you know, TSA started testing some of this new technology to 
help verify passenger IDs and boarding passes. 

They plan to use this technology to eventually replace the cur- 
rent process, the manual process, for inspecting and detecting 
fraudulent or altered documents. 

Today, I would like to discuss two specific issues. No. 1, the sta- 
tus of the actual acquisition for this technology and some broader 
challenges we have previously identified in TSA’s acquisition proc- 
ess that may be relevant for today’s discussion. 

First, regarding the acquisition status, TSA is now preparing to 
start a really important phase of the acquisitions referred to an 
operational test and evaluation and that is the one going to occur 
at three airports, Houston, Dulles, and San Juan. 

During the operational testing, TSA plans to assess the system’s 
performance in terms of three performance criteria, detection capa- 
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bilities, passenger throughput, and availability. Those are referred 
to as key performance parameters. 

According to the acquisition documents we reviewed, the esti- 
mated life-cycle cost of the program is about $130 million based on 
a procurement of 4,000 units over 20 years. 

You have to understand 4,000 includes replacement costs. Out of 
1,400 referred to earlier, that is the planned buy, but since they 
are only expected to last 7 or 8 years, you, ultimately, have to re- 
place them. 

We reviewed the life-cycle cost estimate of the passenger screen- 
ing program and found the estimate to be reasonably comprehen- 
sive and documented. We have clear criteria for evaluating these 
life-cycle cost estimates. 

However, we could not determine the credibility because the cur- 
rent version does not include a risk analysis or independent cost 
estimate as deemed by best practice. 

We also noted that the assumed deflation rate over the life of the 
program is 1 percent rather than the historical rate of 3 to 4 per- 
cent. So, thus, if a higher assumed inflation rate was used, esti- 
mated program costs would definitely be higher. 

More broadly, our prior work has identified three consistent chal- 
lenges that are worth noting as this TSA acquisition unfolds. Our 
prior work emphasizes the importance of establishing and meeting 
clear program requirements, No. 2, properly overseeing and testing 
the technologies you are procuring. 

No. 3, developing sound acquisition program baselines to bench- 
mark progress and meeting initial costs, schedule, and performance 
targets. We previously reported that DHS and TSA have faced 
challenges in developing requirements when acquiring new screen- 
ing technologies. 

For example, in June 2010, we reported that more than half of 
the 15 DHS reviewed, awarded contracts to initiate acquisitions 
without required approval of key acquisition documents. The good 
news for CAT/BPSS is it does have some of these key documents. 
On the other hand, as I noted earlier, we have some concerns about 
the credibility of the life-cycle cost estimate. 

In closing, this hearing provides an excellent opportunity to ask 
some broader questions about the TSA procurement. First, how will 
TSA ensure that this new system addresses the security of 
vulnerabilities it previously identified with the fraudulent IDs? 

Second, what confidence does TSA have in its unit cost estimate? 
Third, how does the screening technology fit into TSA’s broader ac- 
quisition — I am sorry, aviation security strategy? Finally, what 
cost-benefit analysis, if any, is being used to guide TSA decision- 
makers? 

Mr. Chairman, this concludes my remarks. I look forward to re- 
sponding to any questions you may have. Thank you. 

[The statement of Mr. Lord follows:] 
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Prepared Statement of Stephen M. Lord 
June 19, 2012 

aviation security. — status of tsa’s acquisition of technology for screening 
passenger identification and boarding passes 

Chairman Rogers, Ranking Member Jackson Lee, and Members of the committee: 
I am pleased to be here today to discuss our past work examining the Transpor- 
tation Security Administration’s (TSA) progress and challenges in developing and 
acquiring technologies to address aviation security needs. TSA’s acquisition pro- 
grams represent billions of dollars in life-cycle costs and support a wide range of 
aviation security missions and investments. Within the Department of Homeland 
Security (DHS), the Science and Technology Directorate (S&T) and TSA have re- 
sponsibilities for researching, developing, and testing and evaluating new tech- 
nologies, including airport checkpoint screening technologies. Specifically, S&T is re- 
sponsible for the basic and applied research and advanced development of new tech- 
nologies, while TSA, through its Passenger Screening Program, identifies the need 
for new checkpoint screening technologies and provides input to S&T during the re- 
search and development of new technologies, which TSA then procures and deploys. 

TSA screens more than 600 million air passengers per year through approxi- 
mately 2,300 security checkpoint lanes at about 450 airports Nation-wide, and must 
attempt to balance its aviation security mission with concerns about efficiency and 
the privacy of the traveling public. The agency relies upon multiple layers of secu- 
rity to deter, detect, and disrupt persons posing a potential risk to aviation security. 
Part of its checkpoint security controls include a manual review and comparison by 
a travel document checker of each person’s boarding pass and identification, such 
as passports or State-issued driver’s licenses. However, concerns have been raised 
about security vulnerabilities in this process. For example, in 2006, a university stu- 
dent created a website that enabled individuals to create fake boarding passes. In 
addition, in 2011, a man was convicted of stowing away aboard an aircraft after 
using an expired boarding pass with someone else’s name on it to fly from New York 
to Los Angeles. Recent news reports have also highlighted the apparent ease of or- 
dering high-quality counterfeit driver’s licenses from China. We have previously re- 
ported on significant fraud vulnerabilities in the passport issuance process and on 
difficulties in detecting fraudulent identity documentation, such as driver’s licenses. 1 

In response to these vulnerabilities, and as part of its broader effort to improve 
security and increase efficiency, TSA began developing technology designed to auto- 
matically verify boarding passes and to better identify altered or fraudulent pas- 
senger identification documents. TSA plans for this technology, known as Credential 
Authentication Technology/Boarding Pass Scanning Systems (CAT/BPSS), to eventu- 
ally replace the current procedure used by travel document checkers to detect fraud- 
ulent or altered documents. However, we have previously reported that DHS and 
TSA have experienced challenges in managing their acquisition efforts, including 
implementing technologies that did not meet intended requirements and were not 
appropriately tested and evaluated, and have not consistently included completed 
analyses of costs and benefits before technologies were implemented. 2 

Since DHS’s inception in 2003, we have designated implementing and trans- 
forming DHS as high-risk because DHS had to transform 22 agencies — several with 
major management challenges — into one department. 3 This high-risk area includes 
challenges in strengthening DHS’s management functions, including acquisitions; 
the effect of those challenges on DHS’s mission implementation; and challenges in 
integrating management functions within and across the department and its compo- 
nents. DHS currently has several plans and efforts under way to address the high- 
risk designation as well as the more specific challenges related to acquisition and 
program implementation that we have previously identified. For example, DHS pro- 
vided us with its Integrated Strategy for High-Risk Management in June 2012, 
which includes management initiatives and corrective actions to address acquisition 
management challenges, among other management areas. We will continue to mon- 


1 GAO, State Department: Significant Vulnerabilities in the Passport Issuance Process, GAO— 
09-681T (Washington, DC: May 5, 2009), and Transportation Worker Identification Credential: 
Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives, GAO-11- 
657 (Washington, DC: May 10, 2011). We also have on-going classified work looking at the effec- 
tiveness of the travel document checker at detecting fraudulent documents, which we expect to 
finalize later this summer. 

2 For example, see GAO, Homeland Security: DHS and TSA Face Challenges Overseeing Ac- 
quisition of Screening Technologies, GAO— 12-644T (Washington, DC: May 9, 2012). 

3 GAO, High-Risk Series: An Update, GAO— 11— 278 (Washington, DC: Feb. 16, 2011). 
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itor and assess DHS’s implementation and transformation efforts through our on- 
going and planned work, including the 2013 high-risk update that we expect to issue 
in early 2013. 

My statement today focuses on: (1) The status of TSA’s CAT/BPSS acquisition and 
the extent to which the related life-cycle cost estimate is consistent with best prac- 
tices, and (2) challenges we have previously identified in TSA’s acquisition process 
to manage, test, acquire, and deploy screening technologies. This statement also pro- 
vides information on issues for possible Congressional oversight related to CAT/ 
BPSS. 

This statement is based on reports and testimonies we issued from October 2009 
through May 2012 related to TSA’s efforts to manage, test, acquire, and deploy var- 
ious technology programs. 4 In addition, we obtained updated information in June 
2012 from TSA on the status of its efforts to implement our recommendations from 
these reports. For our past work, we reviewed program schedules, planning docu- 
ments, testing reports, and other acquisition documentation. For some of the pro- 
grams we discuss in this testimony, we conducted site visits to a range of facilities, 
such as National laboratories, airports, and other locations to observe research, de- 
velopment, and testing efforts. We also conducted interviews with DHS component 
program managers and DHS Science and Technology Directorate officials to discuss 
issues related to individual programs. More detailed information on the scope and 
methodology from our previous work can be found within each specific report. In ad- 
dition, this statement contains new information we obtained from TSA in June 2012 
on the status of its CAT/BPSS acquisition. We reviewed key acquisition docu- 
ments — including the mission needs statement (September 2008), request for pro- 
posal (April 2011), operational requirements document (August 2011), life-cycle cost 
estimate (November 2011), and acquisition program baseline (November 2011) — 
interviewed officials from TSA’s Office of Security Capabilities, and viewed a dem- 
onstration of the CAT/BPSS test units. We compared the life-cycle cost estimate 
with best practices from our Cost Estimating and Assessment Guide to determine 
whether the official cost estimates were comprehensive (i.e., include all costs), accu- 
rate, well-documented, and credible. 5 We conducted all of our work in accordance 
with generally accepted Government auditing standards. Those standards require 
that we plan and perform the audit to obtain sufficient, appropriate evidence to pro- 
vide a reasonable basis for our findings and conclusions based on our audit objec- 
tives. We believe that the evidence obtained provides a reasonable basis for our find- 
ings based on our audit objectives. We discussed new information in this statement 
with TSA officials and incorporated their comments as appropriate. 

In summary, TSA has completed its initial testing of the CAT/BPSS technology 
and has begun operational testing at three airports. We found the project’s associ- 
ated life-cycle cost estimate to be reasonably comprehensive and well-documented, 
although we are less confident in its accuracy due to questions about the assumed 
inflation rate. In addition, we could not evaluate its credibility because the current 
version does not include an independent cost estimate or an assessment of how 
changing key assumptions and other factors would affect the estimate. Our past 
work has identified three key challenges related to TSA’s efforts to acquire and de- 
ploy technologies to address homeland security needs: (1) Developing and meeting 
technology program requirements, (2) overseeing and conducting testing of new 
screening technologies, and (3) developing acquisition program baselines to establish 
initial cost, schedule, and performance parameters. 

cat/bpss is in the operational testing and evaluation phase, and the life- 
cycle cost estimate is not fully consistent with best practices 

CAT/BPSS, which is part of TSA’s Passenger Screening Program, has undergone 
initial testing and is in the operational testing and evaluation phase of acquisition, 
according to TSA. The goal of CAT/BPSS is to deploy a computerized system that 
will read and analyze data and embedded security features on every passenger’s 
identification and some boarding passes, and to identify fraudulent credentials and 


4 See the related products list at the end of this statement. Examples of these technology pro- 
grams include advanced imaging technology (AIT) — commonly referred to as a full-body scan- 
ner — that screens passengers for metallic and non-metallic threats including weapons, explo- 
sives, and other objects concealed under layers of clothing; explosives detection systems, which 
use X-rays with computer-aided imaging to automatically recognize the characteristic signatures 
of threat explosives; and explosives trace detection machines, in which a human operator (e.g., 
a baggage screener) uses chemical analysis to manually detect traces of explosive materials’ va- 
pors and residue. 

5 GAO, GAO Cost Estimating and Assessment Guide: Best Practices for Developing and Man- 
aging Capital Program Costs, GAO-09-3SP (Washington, DC: March 2009). 
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boarding passes. In 2011, TSA conducted qualification testing of this system at its 
System Integration Facility at Washington Reagan National Airport, including test- 
ing the systems against more than 530 genuine and fraudulent documents, such as 
State-issued driver’s licenses, passports, and military identification cards, according 
to TSA. The technology is designed to automatically compare a passenger’s identi- 
fication with a set of embedded security features to seek to identify indicators of 
fraud and concurrently ensure that the information on the identification and board- 
ing pass matches. This system is intended to help ensure that identity credentials 
and boarding passes presented at the checkpoint have not been tampered with or 
fraudulently produced, and that the information on the boarding pass matches that 
of the identity credential. According to TSA, CAT/BPSS is to compare identity cre- 
dentials with an internal database of more than 2,400 templates for various types 
of credentials and to check for certain embedded security features, then alert the 
operator of any discrepancies. 

In September 2011, TSA awarded contracts for approximately $3.2 million, which 
included the purchase of 30 units from three different vendors. 6 In April 2012, TSA 
began deploying units to three airports — George Bush Intercontinental in Houston, 
Luis Munoz Marin International in San Juan, and Washington Dulles Inter- 
national — in preparation for initial operational testing. TSA officials said that those 
airports were selected, in part, because of their high passenger volume and experi- 
ence with detecting fraudulent documents. In preparation for initial testing, TSA 
tested the performance of its current process for comparison purposes. TSA is also 
training personnel on the CAT/BPSS systems, collecting preliminary data on system 
performance and availability, and assessing the adequacy of the concept of oper- 
ations and standard operating procedures. According to TSA officials, these efforts 
will allow travel document checkers at the three airports to test the three systems 
in an operational environment and provide feedback on the systems’ performance. 
During operational testing, TSA plans to assess the systems’ performance against 
key performance parameters for detection, passenger throughput, and availability. 
Once operational testing is complete, TSA plans to produce a system evaluation re- 
port and recommend whether to move forward with the acquisition or make modi- 
fications. Vendors that successfully exit the operational testing phase will be eligible 
to compete for a contract to produce 1,400 units, according to TSA. 

According to the life-cycle cost estimate for the Passenger Screening Program, of 
which CAT/BPSS is a part, the estimated 20-year life-cycle cost of CAT/BPSS is ap- 
proximately $130 million based on a procurement of 4,000 units. 7 As highlighted in 
our Cost Estimating and Assessment Guide, a reliable cost estimate has four charac- 
teristics — it is comprehensive, well-documented, accurate, and credible. 8 We re- 
viewed TSA’s November 2011 life-cycle cost estimate for the Passenger Screening 
Program and compared it with the four characteristics. Based on our assessment, 
the life-cycle cost estimate is reasonably comprehensive and well-documented. Re- 
garding accuracy, the cost estimate assumes a 1 percent inflation rate from fiscal 
years 2015 through 2029, as compared with the historic inflation rates calculated 
for fiscal years 2009 through 2014, which ranged from 3.3 to 4.5 percent. If a larger 
inflation rate were used, costs would be much higher than what are currently esti- 
mated. In addition, we cannot make a determination as to the credibility of the life- 
cycle cost estimate as it does not include a risk and uncertainty analysis or an inde- 
pendent cost estimate. The risk assessment would quantify risks and identify effects 
of changing key cost driver assumptions and factors. 9 In the cost estimate, TSA indi- 
cates that it is pursuing the acquisition of risk analysis capability and plans on hav- 
ing such capabilities in time for the next life-cycle cost estimate. Likewise, there is 
no evidence that an independent cost estimate was conducted by a group outside 
the acquiring organization to determine whether other estimating methods would 
produce similar results. TSA officials indicated that the agency is updating its life- 
cycle cost estimate to include a risk and uncertainty analysis and independent cost 
estimate, but the document has not yet been approved. 

The agency plans to expand the CAT/BPSS deployment schedule following suc- 
cessful implementation and testing in the selected airport environments. As of June 
2012, TSA officials estimated that this could occur as soon as the end of this cal- 


6 According to TSA, the $3.2 million included costs for maintenance, database updates, and 
training, among other things. 

7 This includes an initial procurement of 1,400 units in fiscal year 2013, and an additional 
2,600 replacement units by fiscal year 2029. 

8 GAO— 09-3SP. The DHS Cost Analysis Division has implemented our Cost Estimating and 
Assessment Guide as the standard for cost estimating at DHS. 

9 DHS did not approve the life-cycle cost estimate due to the lack of risk and sensitivity anal- 
ysis, according to TSA. 
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endar year, depending on the results of the operational testing and evaluation 
phase. 

PREVIOUSLY IDENTIFIED CHALLENGES TSA FACES IN OVERSEEING ACQUISITION OF 
SCREENING TECHNOLOGIES 

Our past work has identified three key challenges related to TSA’s efforts to ac- 
quire and deploy technologies to address homeland security needs: (1) Developing 
and meeting technology program requirements, (2) overseeing and conducting test- 
ing of new screening technologies, and (3) developing acquisition program baselines 
to establish initial cost, schedule, and performance parameters. 

We have previously reported that DHS and TSA have faced challenges in devel- 
oping and meeting program requirements when acquiring screening technologies, 
and that program performance cannot be accurately assessed without valid baseline 
requirements established at the program start. In June 2010, for example, we re- 
ported that more than half of the 15 DHS programs we reviewed awarded contracts 
to initiate acquisition activities without component or Department approval of docu- 
ments essential to planning acquisitions, setting operational requirements, or estab- 
lishing acquisition program baselines. 10 We made a number of recommendations to 
help address issues related to these procurements. DHS generally agreed with these 
recommendations and, to varying degrees, has begun taking actions to address 
them. We currently have on-going work related to this area and we plan to report 
the results later this fall. 11 At the program level, in May 2012, we reported that 
TSA did not fully follow DHS acquisition policies when acquiring advanced imaging 
technology (AIT), or body scanners, which resulted in DHS approving full AIT de- 
ployment without full knowledge of TSA’s revised specifications. 12 

We have also reported on DHS and TSA challenges in overseeing and testing new 
screening technologies, which can lead to costly redesign and rework at a later date. 
Addressing such problems before moving to the acquisition phase can help agencies 
better manage costs. For example, in October 2009, we reported that TSA had de- 
ployed explosives trace portals, a technology for detecting traces of explosives on 
passengers at airport checkpoints, in January 2006 even though TSA officials were 
aware that tests conducted during 2004 and 2005 on earlier models of the portals 
suggested the portals did not demonstrate reliable performance in an airport envi- 
ronment. As a result, we found that TSA procured and deployed a technology that 
met evolving requirements, but not the initial requirements included in its key ac- 
quisition requirements document that the agency initially determined were nec- 
essary to enhance the aviation system. We recommended that TSA develop a road 
map that outlines vendors’ progress in meeting all key performance parameters. 
DHS agreed with our recommendation and has begun taking action to address it. 13 
In June 2006, TSA halted deployment of the explosives trace portals because of per- 
formance problems and high installation costs. In our 2009 report, we recommended 
that, to the extent feasible, TSA ensure that tests are completed before deploying 
new checkpoint screening technologies to airports. DHS concurred with the rec- 
ommendation and has taken action to address it, such as requiring more recent 
technologies to complete both laboratory and operational tests prior to deployment. 

DHS and TSA have also experienced challenges identifying acquisition program 
baselines, which include program schedules and costs. Our prior work has found 
that realistic acquisition program baselines with stable requirements for cost, sched- 
ule, and performance are among the factors that are important to successful acquisi- 
tions delivering capabilities within cost and schedule. We also found that program 
performance metrics for cost and schedule can provide useful indicators of the 
health of acquisition programs. For example, we reported in April 2012 that TSA 
has not had a DHS-approved acquisition program baseline since the inception of the 
Electronic Baggage Screening Program (EBSP) more than 8 years ago. 14 Further, 


10 GAO, Department of Homeland Security: Assessments of Selected Complex Acquisitions , 
GAO-10-588SP (Washington, DC: June 30, 2010). Three of 15 were TSA programs. 

11 We are conducting this work at the request of the Senate Committee on Homeland Security 
and Governmental Affairs and the Subcommittee on Oversight, Investigations, and Management 
of the House Committee on Homeland Security. 

12 See GAO— 12-644T, in which we publicly reported some of the findings and recommenda- 
tions from our January 2012 classified report on TSA’s procurement and deployment of AIT, 
commonly referred to as full-body scanners, at airport checkpoints. 

13 GAO, Aviation Security: DHS and TSA Have Researched, Developed, and Begun Deploying 
Passenger Checkpoint Screening Technologies, hut Continue to Face Challenges, GAO-10—128 
(Washington, DC: Oct. 7, 2009). 

14 GAO, Checked Baggage Screening: TSA Has Deployed Optimal Systems at the Majority of 
TSA-Regulated Airports, hut Could Strengthen Cost Estimates, GAO— 12-266 (Washington, DC: 
Apr. 27, 2012). 
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DHS did not require TSA to complete an acquisition program baseline until Novem- 
ber 2008. According to TSA officials, they have twice submitted an acquisition pro- 
gram baseline to DHS for approval — first in November 2009 and again in February 
2011. An approved baseline would provide DHS with additional assurances that 
TSA’s approach is appropriate and that the capabilities being pursued are worth the 
expected costs. In November 2011, because TSA did not have a fully-developed life- 
cycle cost estimate as part of its acquisition program baseline for the EBSP, DHS 
instructed TSA to revise the life-cycle cost estimates as well as its procurement and 
deployment schedules to reflect budget constraints. DHS officials told us that they 
could not approve the acquisition program baseline as written because TSA’s esti- 
mates were significantly over budget. TSA officials stated that TSA is currently 
working with DHS to amend the draft program baseline and plans to resubmit the 
revised acquisition program baseline before the next Acquisition Review Board 
meeting, which is planned for July or August 2012. Establishing and approving a 
program baseline, as DHS and TSA plan to do for the EBSP, could help DHS assess 
the program’s progress in meeting its goals and achieve better program outcomes. 

Our prior work on TSA acquisition management identified oversight problems 
that have led to cost increases, delivery delays, and other operational challenges for 
certain assets, such as EBSP, but TSA has also taken several steps to improve its 
acquisition management. For example, while we continue to find that some TSA ac- 
quisition programs do not have key documents needed for properly managing acqui- 
sitions, CAT/BPSS has a DHS-approved mission needs statement, operational re- 
quirements document, and acquisition program baseline. 15 

CONGRESSIONAL OVERSIGHT ISSUES 

This hearing provides an opportunity for Congressional stakeholders to focus a 
dialogue on how to continue a sufficient level of oversight of the CAT/BPSS acquisi- 
tion and implementation and other key components of the Passenger Screening Pro- 
gram. For example, relevant questions that could be raised include the following: 

• To what extent, if any, have key performance parameters changed during the 
course of the acquisition, and how will these changes affect security and effi- 
ciency at the checkpoint? What would be TSA’s strategy if vendors have dif- 
ficulty meeting the key performance parameters? 

• How will TSA ensure that implementation of the system addresses the security 
vulnerabilities previously identified? 

• What confidence does TSA have in its cost estimates and how is the agency 
mitigating the risk of cost escalation or schedule delays? 

• In managing limited resources to mitigate a potentially unlimited range of secu- 
rity threats, how does CAT/BPSS fit into TSA’s broader aviation security strat- 
egy? What cost-benefit and related analyses, if any, are being used to guide TSA 
decision makers? 

These types of questions and related issues warrant on-going consideration by 
TSA management and continued oversight by Congressional stakeholders. 

Chairman Rogers, Ranking Member Jackson Lee, and Members of the committee, 
this concludes my prepared statement. I look forward to responding to any questions 
that you may have. 

Mr. Rogers. I thank the gentleman. 

The Chairman now recognizes the Ranking Member for her open- 
ing statement. 

Ms. Jackson Lee. Chairman, thank you for hosting this hearing 
and, as I indicated to you, two committees that I love the most, Ju- 
diciary and Homeland Security and, particularly these subcommit- 
tees seem to have an uncanny ability to overlap their committee 
meetings, particularly mark-ups. 

So let me thank the two witnesses and the Chairman for holding 
this hearing and I would like to have a rhetorical response back 
to the rhetorical question which is the title of this hearing that in- 
dicates whether it is a wise use and I think, to Mr. Hoggan and 
Mr. Lord, the chief responsibility of the hearing today is for you to 
answer that question. 


15 The life-cycle cost estimate was approved by TSA but not by DHS. 
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I have an answer, I think it is wise, but I think the Chairman’s 
inquiry is appropriate, in terms of the procurement or the utiliza- 
tion of funds or the technology and contractor, whether or not we 
are at the best level of efficiencies to ensure that we get the job 
done. 

I hope that I will be able to secure some answers on that very 
point. So I thank the Chairman for holding today’s hearing and I 
know, from our discussions, that we share the same commitment 
to securing our Nation’s transportation systems. We also share the 
same commitment to ensuring that technologies procured by the 
Department are acquired after a robust testing and evaluation 
process. 

Today marks the fourth hearing the subcommittee is holding re- 
garding the procurement practices at the Department and trans- 
portation and security technologies. 

I might add that I have often said that I am interested in small, 
minority, women-owned businesses. I don’t know if they have a 
chance to be engaged in this procurement process and the question 
is would they have been better? Is this a small business or a large 
business? I would be interested in knowing that. 

Although I welcome the delivered oversight of procurement prac- 
tices carried by this committee, I respectfully reassert my request 
that we hold a hearing evaluating TSA’s in-cabin security efforts 
and I look forward to working with the Chairman on determining 
that. 

That is an assessment of TSA’s work if they have that ability 
and as well, airlines and what they are doing for in-cabin security. 
As we learned on September 11, if all else fails, the cabin of an air- 
plane may become our last line of defense. 

Today, we will hear from the Transportation Security Commis- 
sion Government Accountability Office regarding the procurement 
goals by TSA on CAT/BPSS. This system has been deployed for 
testing at three major airports since last April. 

As of today, TSA is still working on reviewing the data it gath- 
ered from testing and evaluating this technology in real-life condi- 
tions. This is a critical step in assessing the effectiveness of any 
piece of technology. As we learned from the puffer machines, what 
works in the lab may not work in real-life and this is a large and 
looming question. 

I look forward to hearing from TSA about its preliminary find- 
ings on the performance of this technology and what you will do 
next. 

I also look forward to hearing about the risk analysis TSA con- 
ducted on the use of fraudulent documents by potential terrorists. 
Last year the media exposed an incident in which a 24-year-old 
man was arrested after attempting to board a flight from a Los An- 
geles airport to Atlanta using outdated boarding passes. 

What was even more alarming was the fact that this same indi- 
vidual had already navigated layers of security at JFK and boarded 
a flight using an outdated boarding pass to fly to Los Angeles 
International Airport. This incident underscored the need for addi- 
tional training and technology to enable TSOs to detect fraudulent 
documents. 
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This is a learning and growing process. We want it to be a learn- 
ing and growing process by saving the lives of Americans. I think 
TSA is committed to that, and I think this technology is one aspect 
of making good on that promise of securing the homeland. 

Since that incident, TSA has been working to identify techno- 
logical solutions to resolve the problem of detecting fraudulent doc- 
uments. The system we will hear about today, CAT/BPSS, may be 
one possible technological solution. 

Science is not perfect. Testing a new technology is part of the 
TAFF — test, test, test, improve the technology, test, test, test, im- 
prove the technology and save lives. There is nothing wrong with 
that. 

I look forward to today’s testimony from GAO and TSA that we 
have already heard, and I thank you for your testimony. I hope 
each will shed light and has shed light on the procurement process 
and — identify the type of technology needed to address the vulner- 
ability. 

As we know, this subcommittee has been particularly interested 
in ensuring that the procurement goals set forth by the Depart- 
ment are administered by the under secretary of management and 
those at TSA. 

Last fall, Mr. Chairman, you held three hearings that examined 
the practices used to evaluate, procure, and deploy technology 
across our transportation system. During these hearings we heard 
from former homeland security officials. They testified about the 
need for greater cooperation between the business and Government 
in developing contract requirements for major research projects. 

While this is an interesting thought, as you know, the Federal 
Acquisition Regulations have strict rules about the depth and 
breadth of permissible discussions between Government and indus- 
try prior to the announcement of a contracting opportunity. I think 
those hearings also made clear that this administration has taken 
action on how TSA and S&T can improve this collaboration. Con- 
gress needs to support and encourage efforts to ensure that Gov- 
ernment is more efficient, genuinely meets the needs of its cus- 
tomers, the American taxpayers, and use our dollars in a fiscally 
responsible way. 

Unfortunately, under our budgetary constraints, we may lose the 
opportunity to get the best technology. Mr. Chairman, we cannot 
use money to fill every security gap, but we cannot ignore money 
in terms of what the needs are for new technology. 

So I look forward to assessing the procurement problem and as 
well to solving the problem if there is one, but to make sure that 
everything we do is to secure the homeland and to save lives. 

With that, Mr. Chairman, I yield back. 

Mr. Rogers. I thank the gentlelady. Now we will turn to ques- 
tions. 

Before I start my questions I wanted to share something with 
Mr. Floggan, which is not your fault, but it is something you should 
be aware of that your staff has done. 

If you will look up on the screens, you will see written testimony 
that was strikingly similar to testimony we got from your prede- 
cessor a year ago. That testimony was from a different hearing on 
a different topic. All of the highlighted content on this page up on 
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the screen was recycled from that hearing. So they basically took 
your predecessor’s testimony from a hearing a year ago and gave 
it to you to regurgitate again this year. 

Slide 2, if they can get that up there — guess not — there it is. This 
slide shows that 7 pages of the testimony TSA was — dedicated less 
than a paragraph to the specific topic of this hearing, and of that, 
some of the material was also recycled. This testimony also does 
not address any of the questions this committee has raised in the 
past month, including questions I specifically raised in a letter to 
Mr. Pistole. 

I try not to waste your time, and I hope you will have your com- 
mittee make sure they don’t waste our time, because it is dis- 
respectful. 

With that, as you know, we talked briefly yesterday and I am 
pleased about the turn of events with your postponement. About 5 
or 6 weeks ago, I along with a number of staff members from both 
sides of the aisle went out to the TSIF to be briefed by your staff 
on this new technology. As a result, we found what it could do, but 
also had real questions about what it couldn’t do and couldn’t get 
our questions answered satisfactorily. We are concerned about the 
cost. 

So we wrote the letter to Administrator Pistole and it is my un- 
derstanding that you all have now postponed it for the third time. 
I want to know if you agree with the statement that if it had not 
been postponed and we had gone ahead with the procurement, with 
its limitations, it would have been a waste of money to do that. 

Mr. Hoggan. Sir, I wouldn’t have proposed going forward with 
procurement as it exists today with the information I know from 
OT&E. 

Mr. Rogers. That is what I thought. 

Well, I am glad. I am glad you came in and recognized that we 
don’t need to be wasting any money. The fact is that, as you know, 
and I have talked with Administrator Pistole about this on numer- 
ous occasions, the public is just outraged by what they see with 
TSA and a lot of the wasteful money that has been spent in the 
past. They are looking for us to be better stewards and also to be 
a little bit more threat-based in our approach and not treat every- 
body like terrorists. 

So it has got a lot of problems, but one of them has been the 
money. In these new, more austere times, we are going to have to 
be good stewards of our Federal tax dollars. 

With that in mind, the cost of this technology skyrocketed, as you 
heard me say earlier. It went from $35 million projected cost in 
2008 to $115 million in 2011. It is a 200 percent increase. Can you 
tell me how that developed? 

Mr. Hoggan. Sir, I will have to get back on you for that. I know 
the original procurement for the 1,400 units could cost anywhere 
from $35 million to $45 million and the life-cycle cost estimate over 
a 20-year time frame would be an additional upwards of $130 mil- 
lion over that time, as Mr. Lord had talked about, that has to do 
with the life cycle being anywhere from 7 to 8 years and a replen- 
ishment factor for 2,600 units to manage it to 1,400 across that 20- 
year time frame. 
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The specifics of the reasons why the changes had happened I will 
have to research that and I will provide that back to you, sir. 

Mr. Rogers. What about this? In 2011, TSA said the cost of each 
machine was going to be roughly $25,000. More recently TSA said 
the cost of each machine is now going to be $100,000. It is a pretty 
big jump. 

Mr. Hoggan. That is incorrect, sir. This is a procurement-sen- 
sitive issue right now, and I could talk to you specifically off-line 
about the individual cost because we are still in the middle of the 
process. 

However, it is not $100,000 per machine. I can assure you that. 

Mr. Rogers. Good, I am glad to hear that. 

It took this committee 3 weeks to share — or it took TSA 3 weeks 
to share with this committee the cost of this program, those num- 
bers which you now point out are incorrect. Given these huge cost 
increases, it is easy to understand why. 

Were you aware it took 3 weeks for your office to get that infor- 
mation to us in the time we requested it? 

Mr. Hoggan. No, sir, I am not. 

Mr. Rogers. Okay. Do you find that acceptable? 

Mr. Hoggan. No, sir, I do not. 

Mr. Rogers. Great. 

Tell me what you see is the purpose of the CAT/BPSS. 

Mr. Hoggan. In 2007 TSA, as a layered approach to security, 
took over the boarding pass ID authentication and review at the 
check point from airline employees or individuals as were subcon- 
tracted by airlines at the departure gates. At that time we em- 
ployed transportation security officers to do the review of the docu- 
ments and the boarding passes. 

What we have found over time — and I will give you the example 
and the numbers — with the 50 States and eight different territories 
we have approximately 600 different permeations of IDs that could 
be presented at checkpoints. 

If you take that into consideration with TWIC cards or CAC 
cards or TESLA cards from the DOD, as well as passports, we have 
upwards of 2,470 different variations of ID’s that could be pre- 
sented at a checkpoint alone for travel, you know, on the air. 

That being said, a TSO who is deployed at Washington Dulles 
might have a very good understanding of driver’s license from Dis- 
trict of Columbia, State of Maryland, State of Virginia, maybe 
State of Pennsylvania or West Virginia, but they don’t have a fun- 
damental pure understanding of IDs from other parts of the coun- 
try. 

Notwithstanding, 2,470 different permeations of ID is hard for 
anybody to get a perspective on. So the technology allows us to 
have good authentication of the different travel documents that are 
presented, whether it is the ID and the boarding pass. The board- 
ing pass also allows us to have the name matches, as well as other 
fields, not least of which is departure date, flight, and so forth to 
ensure that it matches the data. 

So for a human factors component it is very difficult for a TSO 
over time to have a continued high level of proficiency for that 
many variables, but the technology does provide it. 

Mr. Rogers. Thank you. My time is expired. 
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The Chairman now recognizes the Ranking Member for any 
questions she may have. 

Ms. Jackson Lee. I thank the Chairman very much. I thank the 
witnesses again. 

Mr. Hoggan, what is the name of the contractor? Are there many 
contractors or just one? 

Mr. Hoggan. Madam, right now there are three contractors that 
have provided BAE Systems. I would have to look at my notes for 
the exact full names of them, but we have three contractors now — 
presented. There were four original contractors that came in the 
procurement, but only three of them cleared the process. 

Ms. Jackson Lee. Okay. I don’t want to be unfair, but I think 
you have got staff sitting behind you and they are not — we need 
to be helpful to the witness. Maybe they can find it for you, Mr. 
Hoggan, so you won’t have to look. I think they can better look for 
it. 

Are these small companies or medium-sized companies or what? 

Mr. Hoggan. Madam, originally one of them was a small busi- 
ness during the procurement life cycle. Subsequently, my under- 
standing is, it had been purchased by a larger business in the in- 
terim and 

Ms. Jackson Lee. Why don’t you read the names into the record, 
please? 

Mr. Hoggan. Names of record are Trans Digital Technologies, 
BAE Systems, NCR Government Solutions. 

Ms. Jackson Lee. Each are offering their type of technology or 
they are collaborating? 

Mr. Hoggan. Each are offering their own type of technology. 

Ms. Jackson Lee. They are involved in the pilot. 

Mr. Hoggan. Yes, madam, they are, in the OT&E. 

Ms. Jackson Lee. Do you find one technology better than the 
other? 

Mr. Hoggan. Not right now. They are very similar. There are 
unique differences. It is preliminary, as we talked about before. We 
are still in the OT&E process. It just completed last week. We are 
in the process of gathering the data. We had all the machines at 
Dulles for 6 weeks and at San Juan and George Bush Interconti- 
nental for 4 weeks. So we are pulling the data right now. 

But the preliminary information that I have been privy to is that 
they are very similar, but there are some unique differences — 
minor unique differences. One of them might have a harder time 
reading a BlackBerry or 

Ms. Jackson Lee. So you are not going to at this point in time 
say that of the three, two are out and one is in? 

Mr. Hoggan. No, madam, I am not. 

Ms. Jackson Lee. All right. Let me rapidly move forward on my 
questions, so I can get as many in as possible. 

You are not — so therefore the assessment that we have to go 
back to the drawing board comes from where? 

Mr. Hoggan. The assessment comes from the OT&E review as 
it relates to the technology in detection and most importantly as 
well as reliability and speed for the processing. They are not at the 
levels they need to be, and we found these issues as it relates to 
the IDs, the boarding passes. 
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So we want to go back to the manufacturers and update some 
database entries as well as some software 

Ms. Jackson Lee. So the incident that I recited in my statement 
about a gentleman getting on the plane with a false boarding pass 
generated the interest in trying to enhance technology to determine 
about these false documents? 

Mr. Hoggan. No, madam, we actually started this in 2007 with 
integrated product team back when we took over 

Ms. Jackson Lee. What was the purpose of starting this? 

Mr. Hoggan. It was a travel document checking process that we 
took over with the TSOs. This is the fourth procurement event for 
this type activity. We had an RFP go out in March 2009 and we 
had no vendors that qualified with our 

Ms. Jackson Lee. So then you came back? 

Mr. Hoggan. Yes, madam. 

Ms. Jackson Lee. Do you see a value in the utilization of this 
technology if it can be perfected? 

Mr. Hoggan. Yes, madam, I do. 

Ms. Jackson Lee. How does that value translate to securing the 
homeland? 

Mr. Hoggan. It allows us the opportunity to ensure that the peo- 
ple who are traveling, as they present themselves, are who they 
say they are; their ID is authenticated; it matches the boarding 
passes for travel on that day, which then ensures, because there 
are encrypted data that comes through, that all those boarding 
passes have 

Ms. Jackson Lee. So if someone is leaving West Virginia, going 
to Montana, and they have Montana documents, and you are hav- 
ing TSOs who are unfamiliar with Montana documents, can this 
technology enhance that TSO’s ability to protect the homeland by 
knowing whether those are false documents, through that tech- 
nology? 

Mr. Hoggan. Yes, madam. 

Ms. Jackson Lee. So there is a value to it? 

Mr. Hoggan. Yes, madam. 

Ms. Jackson Lee. Let me ask you, Mr. Lord. In your assess- 
ment, is this a valuable technology if it is perfected and if it has 
the efficiencies of scale? 

Mr. Lord. Well, with all due respect, madam, those are major 
“ifs.” That is the purpose of the operational test and evaluation. 

Ms. Jackson Lee. Do you view the operational test as valuable? 

Mr. Lord. Yes. 

Ms. Jackson Lee. Is this what we should be doing? 

Mr. Lord. That is something we have identified in our prior 
work. In the past, TSA’s tended to either not do that or truncated 
the testing. So we think it is very important to take as much time 
as needed in operational tests and evaluation to ensure the tech- 
nology you are procuring meets the original requirements. 

Ms. Jackson Lee. So how many more tests would you suggest 
they have? 

Mr. Lord. Well, it is the length of the testing period. What they 
are doing is they bought two each, as Mr. Hoggan indicated. There 
are three vendors. They are testing two units of each vendors’ tech- 
nology in the three airports. So they purchased. The initial buy was 
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30 for $3 million, so that is how he derived the $100,000 per unit 
cost. 

That is the original up-front cost, but if you are going to pur- 
chase 1,400, obviously, the unit costs are going to come way down. 
But again 

Ms. Jackson Lee [continuing]. Not asking for that right now. 

Mr. Lord. Yes. 

Ms. Jackson Lee. Go ahead. 

Mr. Lord. Again, but the major lesson learned here is slow to 
train down if you have to. There is an old saying in procurement 
circles, “If you want it bad, you get it bad.” So that just under- 
scores — 

Ms. Jackson Lee. So, from your perspective, when you are deal- 
ing with these agencies — and you have just given us a review — do 
you see the validity in this technology, but what you are bringing 
to us as a committee, in terms of our oversight, is to slow this proc- 
ess down; be deliberative; ensure that the technology will do what 
it is supposed to do? 

Mr. Lord. Before going with your plan, you know, the full buy, 
yes. 

Ms. Jackson Lee. Full steam ahead. 

Mr. Lord. Yes. 

Ms. Jackson Lee. This is my last — do you have any concern that 
these machines, this technology cannot stand by a checkpoint and 
operate themselves; it requires a TSO personnel? 

Mr. Lord. Yes, it definitely requires — in fact, if you looked at the 
total life-cycle costs of the program, by and large, the biggest com- 
ponent is cost of the TSOs to operate the machines. 

Ms. Jackson Lee. But if the TSOs are already there, so the cost 
is just the TSOs there now working the equipment. Is that correct? 

Mr. Lord. Well, it is going to require some training. That is an- 
other concern I have. TSA indicated earlier they are planning to 
roll this out in December, but you not only have to complete the 
operational tests and evaluation; you have to train new staff. 

So I am encouraged to here today they are thinking of moving 
that date to the right. 

Ms. Jackson Lee. So you would be comfortable if, No. 1, we had 
a more deliberative — when I say we, the oversight of TSA, had a 
more deliberative approach — and I am glad for your report, to be 
very honest with you — and that you would certainly want TSOs to 
be trained? 

Mr. Lord. Properly trained. 

Ms. Jackson Lee. But in your looking at the technology, since 
you have that expertise, do you see it as having some ultimate 
value if done right? 

Mr. Lord. Well, it is — the technology is designed to address a 
real vulnerability, and that is the use of fraudulent IDs and board- 
ing passes. So assuming you can get the technology to work prop- 
erly and it meets requirements, there obviously would be some 
value in addressing that vulnerability. 

Ms. Jackson Lee. Mr. Chairman, I thank you. 

Mr. Lord, thank you for affirming the value of saving lives 
through adequate and efficient technology, and how we can work 
through this is, I think, an important point going forward. 
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Mr. Chairman, thank you. I yield back. 

Mr. Rogers. I thank the gentlelady. The Chairman now recog- 
nizes the gentleman from Minnesota, Mr. Cravaack, for 5 minutes. 

Mr. Cravaack. Thank you, Mr. Chairman. 

Mr. Hoggan, you having fun so far? 

Mr. Hoggan. Yes, sir, I am. 

Mr. Cravaack. Good to hear. Good to hear. Well, anyway, thank 
you for being here today. 

Just some quick questions. In studying for today’s committee 
hearing, I just had some questions in regards to the system itself. 
As I understand it, this system is not linked to any no-fly lists or 
any type of State or Federal database. Is that correct? 

Mr. Hoggan. That is correct. Right now, it is not linked. There 
is an interoperability requirement in the operation requirements 
document. I believe it is in Section 3.2, Mr. Rogers, as we provided. 
It says it allows the opportunity, going forward in time, to do that. 
It is not in our original requirements this time, but if we find, 
going forward, that we need to hook to either something internal 
or external, there is an opportunity to do that, depending on what 
it is as well as taking into concerns, privacy concerns 

Mr. Cravaack. Well, taking into account your answer, sir, my 
question would be, technically, if a person were able to, you know, 
fabricate a pretty good fake ID, you could have the same person at 
the same address flying on the same day, practically at the same 
time, without interoperability of the machines themselves. Would 
that be a correct statement? 

Mr. Hoggan. Not necessarily because, the — ID, we have con- 
fidence that the equipment could get it. The no-fly list, sir, may I 
remind you, is connected through the airlines reservation systems. 
So that check will be done behind the scenes before the boarding 
pass is actually generated. So that check should already have been 
done. 

Mr. Cravaack. Okay. But in regards to just the ID themselves, 
wherever there is an offensive measure, there is always a counter- 
measure that will happen later on. We have seen that through the 
years. As a military person, I understand that completely. But the 
bottom line is this system does not track travel patterns. It doesn’t 
track who is flying on a certain day or anything of that nature; it 
just takes a look at the idea itself and goes from there. Is that cor- 
rect? 

Mr. Hoggan. That is correct, sir. 

Mr. Cravaack. Okay. The other questions I have — how are iden- 
tifications of an ID — become — there is a question about the ID 
itself. How is that situation then handled? 

Mr. Hoggan. If an ID has some type of warning or notice 
through the process, the TSO then takes a manual review of the 
ID, depending on what the different criteria was that caused the 
error. There is also opportunity in the SOP that a supervisory TSO 
actually does another review on top of that as well. Keep in mind 
we also still have a layered approach based on the behaviors and 
whether it is the TSO watching or behavior detection officers. But 
it is run through a next-level, second-tier, third-tier review. 

Mr. Cravaack. Well, my question is the technology could be such 
that there is such a high rate of passengers subject to additional 
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screening because of the false alarm rate being set at a high level 
that people could be going through security and, really through no 
fault of their own, because they have a valid ID, could also be sub- 
ject to more intense scrutiny. 

So I am a little concerned about that and what I have been read- 
ing so far on the technology. 

Mr. Hoggan. You are absolutely correct. Some of the preliminary 
information we are finding during the testing phase, and we want 
to go back and address those specific areas of concern and go back 
with the vendors as relates to the database as well as the algo- 
rithms and make those modifications and changes. 

It is currently performing very near the standard it is supposed 
to be at in some areas. In others, it is not, and we need to address 
that. So that is the intent of extending the test and evaluation. 

Mr. Cravaack. Has the TSA worked in conjunction with S&T Di- 
rectorate or the DOD? 

Mr. Hoggan. Yes, sir. We work with S&T as it relates to our 
operational test and evaluation. We are a DHS-approved testing fa- 
cility for this type of technology. 

Mr. Cravaack. Okay, that is good to hear. 

Mr. Lord, can you tell me that TSA — and, kind of, jumping on 
what Ms. Jackson was saying, the TSA has said in the past, at 
least in my readings, that this technology, the purchase of this 
technology, would help reduce workforce needs? 

Is that a true or incorrect statement? 

Mr. Lord. I am not sure at this point, sir. I would have to go 
back and look at the workforce projections. But, again, this is not 
a piece of technology that works — I mean, it works in conjunction 
with the transportation screen officer. He is still standing at the 
platform and he is on — the technology gives you read, essentially 
red light/green light, and he is the one that has to interpret that 
and then make the judgment, in some cases referred a person to 
secondary screening or another person for review. 

So it does not eliminate the need for a TSO, just to be clear. 

Mr. Cravaack. So it would not necessarily reduce workforce. 

I have just been handed a note from our staff that S&T is saying 
that they didn’t play any role in your study, sir. So seeing that 
time is over, will there be a second round, sir? 

Okay. With that, sir, I will yield back. 

Mr. Rogers. Thank you. The Chairman now recognizes Mr. 
Walberg for any questions he may have. 

Mr. Walberg. Thank you, Mr. Chairman. 

Mr. Hoggan, currently this technology doesn’t connect to any 
other State or Federal database, as I understand. 

Mr. Hoggan. That is correct, sir. 

Mr. Walberg. To me, that seems like an obvious vulnerability 
for coordination that generally you think would be important. What 
plans does TSA have to link this technology to other databases in 
the future? 

Mr. Hoggan. It is something that we need to review once we get 
the original requirements moving forward. That is in the second 
phase, to make that determination. Originally, this program was 
set to do ID authentication and then boarding pass matching with 
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the names. As we go forward in time, that is definitely something 
we will review. 

Mr. Walberg. Speaking of review, could you describe the initial 
results from the operational testing and evaluation of the tech- 
nology at Dulles, at George Bush International — or Interconti- 
nental Airport, basically those airports, what were the results of 
the operational testing? 

Mr. Hoggan. Well, the operational testing just completed last 
week, so they are providing the reports to me now. But the anec- 
dotal information I have been giving is that there are some issues 
as it relates to boarding pass authentication, whether it is 
encrypted with — you need to have 2D bar codes to have it 
encrypted; ID doesn’t necessarily do that. 

There are some issues when name matches, presentation of 
names — first, last and changes. There are also some issues as it re- 
lates to IDs. 

You know, some States, like I said, with the 50 States and the 
eight territories, there are 600 permeations. I have in my pocket 
right now a Virginia State ID that is well over 5 years old, but 
there are a lot of individuals who have different IDs. 

So you also have problems with wear on the IDs, and different 
security features on there that are causing problems, as well. So 
these are the little things we are looking at. There is a slight prob- 
lem with one of the vendors as it relates to reading mobile board- 
ing passes. There are some changes that have to be done on that. 

But the exact specifics, I don’t have a full document. This is just 
anecdotal information I have from talking with individuals. 

Like I said, we just completed that. We are still in the process. 
We haven’t finished it. So if you would like, as soon as I have that 
preliminary report I would be more than happy to share it to the 
committee. 

Mr. Walberg. I think we would appreciate that. 

Mr. Hoggan. Okay, sir. 

Mr. Walberg. In your view, how does the technology propel TSA 
forward in a more economical threat-based — as a more economical 
threat-based agency? 

Mr. Hoggan. Economical in meaning the saving — the TSOs in 
the process? 

Mr. Walberg. Savings across the board. 

Mr. Hoggan. Well, as Mr. Lord had said, the original require- 
ments document showed a processing rate of 240 passengers an 
hour, which is comparable to the planning, staffing levels that we 
have today. So I will have to research and find the documentation 
that, Chairman Rogers, you had referred to, as well as you, sir, 
that it would be a savings. Right now I don’t project it to be a sav- 
ings of staff. I project it to be an increased opportunity to cover a 
vulnerability that we have and have a better detection capability 
as it relates to fraudulent IDs as well as ensuring that the pas- 
senger is the one that has gone through the Secure Flight engine. 

But as it relates to the economics of saving FTE or TSOs, I don’t 
see that being the case right now. So I will have to research the 
documents that you refer to. 

Mr. Walberg. Thank you. Mr. Lord, given TSA’s track record of 
having a continuously expanding workforce, do you think that this 
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technology realistically could lead to a reduction in the TSA work- 
force needs? 

Mr. Lord. I am not sure at this point. We will have to wait and 
see how the tests and evaluation phase goes. Again, that is still 
being tested. So they anticipated some reductions initially. But I al- 
ways like to see how the testing goes before finalizing my judg- 
ment. 

The good news is they are conducting a separate operational test 
and evaluation phase for the technology. As Mr. Hoggan indicated, 
they are already identifying some issues with throughput and char- 
acter recognition, et cetera. 

So that is — I mean, that is good. They are trying to fix the bugs, 
so to speak. 

Mr. Walberg. In your experience, Mr. Lord, when a Government 
agency is planning procurement, do they generally have a sense of 
what the cost will be? 

Mr. Lord. Oh, yes. The DHS acquisition guidance requires before 
you start purchasing, before — it is called — at the end of the so- 
called analyze phase you are supposed to have a validated life-cycle 
cost estimate. So you are supposed to have a pretty good idea what 
your costs are going to be. It is not sufficient to just generate a life- 
cycle cost estimate. You have to have a review by an outside party 
to help ensure there is no bias in their projections. 

We note, at least with this program, as part of this passenger 
screening program, the life-cycle costs for the larger program is yet 
to be validated by an outside entity, so that is something I raise 
in my statement today, a concern. 

So, you know, we are not sure what the costs are gonna be at 
this point. 

Mr. Walberg. Thank you. I yield back. 

Mr. Rogers. I thank the gentleman. 

I want to pick back up where my questioning left off when I had 
asked Mr. Hoggan the purpose of the CAT/BPSS. I would ask Mr. 
Lord, do you believe the CAT/BPSS would identify terrorist threat? 

Mr. Lord. Well, that is a really important question. It is oriented 
to detect the use of fraudulent IDs. There have been some in- 
stances where — in the past where terrorists have been exposed 
and — have used fraudulent IDs. But, again, you have to make the 
overall judgment. The system is gonna cost over $100 million. Is 
it — it is gonna provide some incremental benefit. Is it justifiable? 
I have not seen the cost-benefit analysis that clearly lays that out. 
But there have been instances in the past — terrorists have used 
fraudulent documents. So it potentially could help address that vul- 
nerability. But 

Mr. Rogers. I would ask either one of you if you are aware if 
TSA’s done a cost-benefit analysis of the potential costs against the 
benefit that we would incur. 

Mr. Hoggan or Mr. Lord, either one. 

Mr. Lord. I haven’t seen one. Mr. Hoggan could correct me if 
needed. 

But part of the problem is that a key component of that is the 
life-cycle cost assessment, and that is not completed yet because it 
hasn’t been fully validated. So I am not sure how they could do one 
because that is a big piece of it, having a validated cost 
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Mr. Rogers. Do you know, Mr. Hoggan? 

Mr. Hoggan. Mr. Lord is correct, we actually submitted our life- 
cycle cost estimate to DHS in November 2011. It came back in the 
spring of 2012 for review and adjustment, as well as an introduc- 
tion of the risk analysis that is in review. We expect to have it back 
to DHS inside of 30 days, sir. 

Mr. Rogers. Do you know, Mr. Hoggan if the CAT/BPSS is in 
any way based upon or pulling from intelligence about a known 
terrorist threat? You know, one of my concerns when we were out 
there was the no-fly list was not pegged against what it was scan- 
ning for. 

Mr. Hoggan. The no-fly list right now as I was talking to the 
gentleman comes through the air carriers as it relates to the 
issuance of the boarding passes. So that is how it is tied into the 
system. 

Now, if you are asking whether the system 

Mr. Rogers. So you are saying the boarding pass 

Mr. Rogers [continuing]. Pinged off the no-fly list? 

Mr. Hoggan. Yes, sir, to be able to get the boarding pass gen- 
erated by the air carrier it must go through the Secure Flight proc- 
ess. 

Mr. Rogers. You know, the biggest threat that we are facing 
right now when it comes to air security is the non-metallic explo- 
sive device. Do you know if there is anything about this other than 
detecting somebody is not who they pretend to be that would detect 
an explosive device on the person? 

Mr. Hoggan. No, sir. This is a credential authentication and 
boarding pass authentication. It has got nothing to do with screen- 
ing of the passengers. 

Mr. Rogers. Okay. 

I want to go back to Mr. Walberg’s questions. One of the things 
I was wondering when they were demonstrating the devices to our 
group was why would we still need TSOs — if they can develop this 
technology so it has a higher degree of proficiency and we feel com- 
fortable that it will add benefit, why would we need a TSO to put 
the driver’s license or the boarding pass in the machine? Why 
couldn’t we let the passenger do that and then if the green light 
goes off a little gate open and they can walk on through? All you 
need is one TSO to watch each of the gates to make sure people 
only going through on a green light, or if somebody got a red light 
then go over and interdict. 

You know, why do we have to have just as many people — you 
know, you go to McDonald’s now and you pour your own Coca-Cola, 
you know. Why can’t we just take some of that approach? 

Mr. Hoggan. Because we are — the technology is not there, yet, 
sir, to be honest with you. As I said, this is the fourth time we have 
gone through. The first time we put an RFP out we had zero ven- 
dors that actually met our requirements. The second time we had 
one, and we couldn’t have a procurement with just one vendor. 
This was in March, if I am not mistaken. I have it written down, 
if — I can tell you the exact months if you want — but it would have 
been in March 2009. 

Then again it would have been — I am sorry — July 2009. Then a 
third time there were no vendors that met the requirements, the 
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minimum requirements — in October 2010. This is the fourth time 
they came through, which is April 2011. 

In a perfect world, going forward in time, is that technology ma- 
tures, and part of our spiral development and getting technology 
that meets our baselines, I could foresee that happening. But as it 
exists today with the technology you still have to have the TSO 
there to do a couple things. 

The first thing that is most important is a visual check to make 
sure that the picture on the ID matches the person 

Mr. Rogers. Right, right. 

Mr. Hoggan [continuing]. That presents themselves, as well as 
ensuring that the compliance of the boarding passes are actually 
compliant in ensuring all the information is in there as it relates 
to 

Mr. Rogers. See, the machine ought to do that, though. Before 
you ever purchase that machine, the second 

I agree first item is a point that is valid. The second item, that 
machine ought to tag that base. 

Mr. Hoggan. You are absolutely correct. The machine does that. 
But if the information is not provided accurately from the carriers 
as they present the information on the boarding pass, the machine 
can’t read what is not there. So that is why we continue to have 
outreach with the carriers to ensure that we have the encryption 
and we have the information in the specific fields in the boarding 
pass that we want in the bar code 

Mr. Rogers. Right. 

Mr. Hoggan. Provided we have that and we have a good rep- 
resentation and a consistent representation of that information of 
the passenger, I could accept your comment. But right now it is not 
there. 

Mr. Rogers. Well, you know, as I told you yesterday, one of the 
things I would invite you all to do — and I have done this with de- 
partment heads across the entire Department — is to have more of 
an open dialogue with the private sector about what you are trying 
to do. I think you may find these goals are achievable, including 
the self-service approach, if we think about it and we talk about 
the subject matter with the private sector before we do the RFP. 

But thank you very much. 

We will now go to Mr. Cravaack for a second round of questions. 

Mr. Cravaack. Thank you, Mr. Chairman. 

Thank you, again. 

I wanted to just say thank you for the prescreening for our 
troops. Appreciate that. I mean, we are going to the risk-based 
analysis, so thank you. It gives me a nice smile when I see a troop- 
er that is coming back from Afghanistan able to not be strip- 
searched and able to get through. So thank you very much. 

With that said, in regard to the risk-based analysis, the deploy- 
ment of the machines themselves, I have read, is going to be evenly 
distributed throughout the system. Would that be a correct state- 
ment? 

Mr. Hoggan. The original deployment plan as listed in the oper- 
ations requirement document would be the purchase of 1,400 units, 
which simple math says if we have 2,800 lanes it is one for every 
two, and that was what was in there. 
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As it relates to which ones go where and which sequence, if in 
fact that we did purchase all 1,400 based on the requirements, 
there would be threat-based and risk-based. 

Mr. Cravaack. Okay. 

Mr. Hoggan. It would be deployed at our higher-risk air- 
ports — 

Mr. Cravaack. Good. 

Mr. Hoggan. I am sure JFK would get it before a much smaller 
airport that only handles 10 passengers a day, sir. 

Mr. Cravaack. Yes, as I understand it they were supposed to be 
all deployed at one time, so that is 

Mr. Hoggan. Yes, that couldn’t happen. We would never deploy 
anything at one time. 

Mr. Cravaack. Yes, okay. 

Mr. Hoggan. It would be staggered based on risk, sir. 

Mr. Cravaack. Yes, I read that. 

Just to make sure that I understand what this system does, it 
is a stand-alone system, is that correct? It isn’t 

Mr. Hoggan. That is correct, sir. 

Mr. Cravaack. No interoperability with any other Federal, State, 
or airline databases, is that correct? 

Mr. Hoggan. For the machine — correct. 

Mr. Cravaack. At the same time, does not alleviate any work- 
force demands upon the system, is that correct? 

Mr. Lord. That is correct. 

Mr. Cravaack. Okay. 

We really don’t have any source of action regarding false alarm 
rates and, you know, how do we adjust for that and making sure 
that the system works correctly and what we do with false alarms 
and what kind of false alarm rate system we have, is that correct? 

Mr. Lord. Well, we are in a process of reviewing that with DOE 
T&E. We have standards that we have for the machines to choose 
it. But there will be a protocol in place to address anything that 
is a false alarm not unlike what we had the day with our other 
technology and checkpoints. 

Mr. Cravaack. Okay, then with all that said, and I commend 
your decision to not pursue rolling the system out until those ques- 
tions are answered, I can’t support this program whatsoever. 
Though like the Chairman says, the concept is great, but we have 
to — before we do something like we did with the puffer machines 
and spent a lot of the taxpayers’ hard-earned money on systems 
that don’t work, I highly recommend, sir, that you step back, re- 
evaluate the situation and then make sure that we have the proper 
procedures and the proper equipment with the layered security 
that you were just — we all want and need to make sure our trav- 
eling public is safe. 

So with that, thank you very much sir, I appreciate all your in- 
formation, Mr. Lord as well. 

I will yield back. 

Mr. Rogers. I thank the gentleman. 

The Chairman now recognizes Mr. Walberg for a second round 
of questions. 

Mr. Walberg. Thank you, Mr. Chairman. 
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Going back to analysis, Mr. Hoggan, did TSA use independent 
cost validation? 

Mr. Hoggan. We did not, I don’t believe we did, sir. 

Mr. Walberg. Okay, so no concern about looking, letting some- 
one outside look in? 

Mr. Hoggan. It is my understanding that we performed with the 
DHS acquisitions directorate but I will double check that. I am not 
sure that that is in there. I will have to follow up, I apologize, I 
will have to get information back with you on that, sir. 

Mr. Walberg. Then let me ask you, has TSA developed proce- 
dures for the travel document checker if the technology we are dis- 
cussing at the checkpoint experiences a system failure, would there 
be a TSO there trained in the lights and loupes method? 

Mr. Hoggan. Yes, absolutely sir, that would be a backup for the 
procedure that we have in place, not unlike what actually exists 
across the Nation. 

Mr. Walberg. Any other backup other than that in case the sys- 
tem goes down? 

Mr. Hoggan. No, you would refer back to the process that we 
have in place. Again, this is a huge vulnerability we hope to cover 
and move it — refer back to what we are doing today. 

Mr. Walberg. Thank you. 

Mr. Lord, you have got definitely a lot of experience in assessing 
weaknesses in TSA’s past procurements. What concerns me and I 
think our committee is that it appears that the TSA is not applying 
lessons learned from its past missteps to this procurement. 

Can you discuss some of the problems that you identify with 
TSA’s procurement process for this technology thus far? 

Mr. Lord. In general, the lessons learned have been a three-fold. 
First, it is important to test and evaluate any technology you are 
procuring. It is important to have clear requirements set up front 
so you can measure what are the — requirements. It is also impor- 
tant to adhere to, you know, to document the major decisions. 
These are some of the lessons learned. 

We have found in the past and specific to this platform, one 
thing Mr. Hoggan noted as there could be some issues related to 
throughput, which is related to throughput, which is, you know, an 
important consideration to look at when you are evaluating the 
technology. So rather than change the requirements, we would like 
to know: Is TSA going to respond to that concern? 

Well they hopefully take a little longer and work with the vendor 
and ensure they get the throughput they are looking for rather 
than modify and of the, you know, the requirements. 

Mr. Walberg. Okay. 

Thank you. 

I yield back. 

Mr. Rogers. Just one point of clarification, Mr. Hoggan. In re- 
sponse to Mr. Walberg’s question, you referred to this false identi- 
fication problem as being a huge vulnerability. Could you expand 
on that? What did you mean by it? 

Mr. Hoggan. It is a vulnerability, I am sorry if I said huge. But 
there is a vulnerability that we need to ensure that the 

Mr. Rogers. Well I agree. When you said huge, it made me think 
that this was a much more prominent problem 
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Mr. Hoggan. I am sorry, I meant a vulnerability 

Mr. Rogers. Right, right. 

Mr. Hoggan [continuing]. Not a huge vulnerability. 

Mr. Rogers. I knew that we had occasional false IDs, I didn’t 
think it was happening that much except down on the border now, 
we have them all the time coming in our ports of entry down in 
El Paso and other places. So we might see this technology being 
used in some of those ports of entry, hopefully only at a much 
lower cost because these numbers are pretty staggering. 

But with that, I want to thank the witnesses for their time. I will 
remind you that the Members who could not be here because of 
conflicts may have questions and these Members as well as I may 
have some additional questions we will submit to you in writing. 

So for the next 10 days, this hearing will remain open for that 
purpose. If you do get those written questions, I would ask that you 
provide timely responses to those. Thank you again. 

This hearing is adjourned. 

[Whereupon, at 2:17 p.m., the subcommittee was adjourned.] 
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